Tailscale Rushes Patches After Uncoordinated Disclosure of ‘Tailworm’ Flaws
Tailscale is getting ready to ship a client update that addresses privilege escalation weaknesses in Tailscale SSH. Details of the bugs went public over the weekend.
Tailscale provides a mesh VPN service that uses the WireGuard protocol to connect an organization’s devices and services over a private, peer-to-peer network.
The Tailscale vulnerabilities, dubbed Tailworm, are described in a report from Cyberdione Labs. It lists 11 findings affecting version 1.104.2 of the Tailscale client and version 0.29.5 of headscale, an open source control server that organizations can host themselves.
Cyberdione Labs published the report before any patches were available, drawing criticism on social media, though the researchers argued that rapid awareness would speed up remediation.
Six of the findings are rated high severity, and four of them concern Tailscale SSH, which grants access based on device identity and network policy instead of passwords or keys.
According to the Tailworm report,...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
